The 22 Amazon Bedrock security checks Black Cat runs

Black Cat SSPM evaluates 22 security policies against your Amazon Bedrock configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect Amazon Bedrock — what access Black Cat needs, and why.

• Access control & privilege

  4 checks · highest severity: critical

• Data sharing & exposure

  4 checks · highest severity: medium

• Configuration hardening

  4 checks · highest severity: high

• AI governance

  5 checks · highest severity: critical

• Lifecycle & offboarding

  4 checks · highest severity: critical

Access control & privilege (4)

• Bedrock Agent Overprivileged Execution Role  · severity: critical
• Bedrock Agent Cross-Account Role  · severity: high
• Bedrock Agent No Guardrail  · severity: high
• Bedrock Agent Excessive Action Groups  · severity: medium

Data sharing & exposure (4)

• Bedrock Agent Multiple Knowledge Bases  · severity: medium
• Bedrock Agent No Customer-Managed Encryption  · severity: medium
• Bedrock Agent Session Memory Enabled  · severity: low
• Bedrock Agent Long Session TTL  · severity: medium

Configuration hardening (4)

• Bedrock Guardrail Weak Content Filters  · severity: medium
• Bedrock No Guardrails Configured  · severity: high
• Bedrock Flow References Draft Prompt  · severity: medium
• Bedrock Orphaned Knowledge Base  · severity: low

AI governance (5)

• Bedrock Action Group Code Interpreter  · severity: high
• Bedrock Action Group Computer Use / Bash  · severity: critical
• Bedrock Agent Custom Orchestration  · severity: low
• Bedrock Agent Supervisor Mode  · severity: medium
• Bedrock Agent High Risk Unblocked  · severity: high

Lifecycle & offboarding (4)

• Bedrock Agent Failed Status  · severity: critical
• Bedrock Agent Not Prepared (7+ days)  · severity: medium
• Bedrock Agent Stale  · severity: low
• Bedrock Agent Orphaned Owner  · severity: high

Other checks (1)